Vulnerability Disclosure Policy — Kiubit

Plain-language summary

Report vulnerabilities to security@quamrailsinvestir.com. We respond within 24 hours, fix critical issues within 7 days, and pay bounties up to $50,000.

1. Scope

All Quamrailsinvestir smart contracts on Arbitrum, the web application, API endpoints, and related infrastructure.

2. How to Report

Email security@quamrailsinvestir.com with description, reproduction steps, impact assessment, and wallet address for bounty.

3. Response Timeline

Acknowledge: 24 hours. Assessment: 72 hours. Fix: 7 days (critical), 30 days (high), 90 days (medium/low).

4. Bounty Amounts

Critical: up to $50,000. High: up to $15,000. Medium: up to $5,000. Low: up to $500. Paid in USDC.

5. Rules of Engagement

Don't exploit beyond proof-of-concept. Don't access others' data. Don't disclose before fix. Act in good faith.

6. Safe Harbor

We will not pursue legal action against good-faith researchers following this policy.